A company has an application that uses an Amazon S3 bucket for object storage. A developer needs to configure in-transit encryption for the S3 bucket. All the S3 objects containing personal data…

Question

Options

• AWrite an S3 bucket policy to allow only encrypted connections over HTTPS by using permissions
• BConfigure an S3 bucket policy to enable client-side encryption for the objects containing personal
• CConfigure the application to encrypt the objects by using an AWS KMS customer managed key
• DWrite an S3 bucket policy to allow only encrypted connections over HTTPS by using the
• EConfigure S3 Block Public Access settings for the S3 bucket to allow only encrypted connections

• A
  13% (4)
• B
  3% (1)
• C
  77% (23)
• E
  7% (2)

Explanation

C is correct because AWS KMS customer managed keys (CMKs) are the only KMS key type that supports on-demand rotation - AWS managed keys rotate automatically on a fixed schedule but cannot be rotated on demand, making CMKs the right fit for this requirement.

D is correct because enforcing in-transit encryption on S3 requires a bucket policy with a Deny statement using the aws:SecureTransport: false condition key - this blocks any HTTP (unencrypted) requests and is the AWS-recommended mechanism for requiring HTTPS.

A is wrong because it describes the same intent as D but omits the critical aws:SecureTransport condition key - without that specific condition, the policy won't correctly enforce HTTPS-only access. B is wrong because S3 bucket policies cannot configure or enforce client-side encryption; that logic lives in the application, not the bucket policy. E is wrong because S3 Block Public Access controls public accessibility of objects, not transport-layer encryption - it does nothing to enforce HTTPS.

Memory tip: Think "CMK = Can Manually rotate" for the KMS at-rest requirement, and remember aws:SecureTransport as the "in-transit" condition - both words contain the core concept they enforce.

No community discussion yet for this question.